Social Engineering

01

Reconnaissance

After scoping is defined and parameters set, our consultants start with general reconnaissance and attack surface mapping.

• Assess public exposure of company and staff (social media, data dumps, other public sources)
• Identify software used such as online services (data leakage through publications, analysis of DNS records)
• Indepth OSINT research

02

Planning

After conducting our intial research, our consultants establish the best plan of attack for example

Phone Phishing

SMS phishing with Email support

Phyiscal Intrusion, etc.

After we have planned our approach, our team crafts the contents of the campaign specific to our targets.

03

Preparation

This is always different for each social engineering engagement. As our consultants decide what is the best approach to target the organization, within in the scope and rules set by the client. However, to list some examples of preparation:

Register Typo domains of targetted organization

Set up fake email accounts of senior staff members

Clone login pages to steal credentials

Apply for a job at the targetted company

04

Attack & Reporting

In this phase our consultants launch the attack on the targetted company. This could range from:

Mass phishing emails

Highly targetted phishing emails to senior staff

Mass Sms alerts to staff members

performing onsite engagement

During this phase, employees who become aware of a threat can get concerned, this is why we always have the right safeguards in place and stay in communication with our appointed staff member(s).
After the attack is performed, our consultants provide a full report with recommendations. Finally we offer multiple aftercare options to ensure your organization is ready for real threats.